The Daily Index — Friday, May 30, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

THREAT ACTORS ABUSE GOOGLE APPS SCRIPT IN EVASIVE PHISHING ATTACKS

Threat actors are exploiting Google Apps Script to create phishing pages that mimic legitimate sites, enhancing their credibility. This tactic reduces the likelihood of detection by security tools. As a result, users may be more easily deceived into providing sensitive information.

bleepingcomputer.com · 2 min

TLDR InfoSec

FAKE CHATGPT AND INVIDEO AI DOWNLOADS DELIVER RANSOMWARE

Cisco Talos has discovered three malware families—CyberLock ransomware, Lucky_Gh0$t ransomware, and Numero malware—that disguise themselves as legitimate AI tool installers for ChatGPT, InVideo AI, and NovaLeadsAI. These threats spread through SEO poisoning, social media, and messaging platforms, specifically targeting sales, technology, and marketing businesses. CyberLock demands $50,000 in Monero cryptocurrency, Lucky_Gh0$t encrypts files under 1.2GB while destroying larger ones, and Numero renders Windows systems unusable by interfering with the graphical interface.

hackread.com · 3 min

TLDR InfoSec

DETECTION-IN-DEPTH

Detection-in-depth is a detection engineering concept modeled after the principle of defense-in-depth, in which security teams create detections to catch an attacker at every step of the attack chain. Detections (including out-of-the-box detections that come with a platform) must be fine-tuned to the specific environment to reduce false positives. They should be tested using threat emulation tools such as Atomic Red Team and penetration testing activities.

dispatch.thorcollective.com · 10 min

TLDR InfoSec

HTML TO PDF RENDERER: A TALE OF LOCAL FILE ACCESS AND SHELLCODE EXECUTION

In a recent engagement, a penetration tester from Neodyme tested a tool that converted HTML to PDF. The tester's first instinct was to attempt Server-Side Request Forgery (SSRF), which they succeeded in doing in a test environment. They then discovered that they could enumerate information about the engine and local files. The tester then found an exploit against the outdated Chromium browser used by the converter to render the HTML and adapted it to obtain shellcode execution on the server.

neodyme.io · 11 min

TLDR InfoSec

DECODING TCP SYN FOR STRONGER NETWORK SECURITY

NETSCOUT analyzed TCP SYN segments from honeypots to identify network security patterns, examining source addresses, IPv4 TTL values, and TCP header lengths. The study found no source address spoofing despite expectations, discovered that TTL values varied widely from the same sources due to path diversity, and identified that many anomalies correlated with crafted packets from suspicious networks. The research demonstrates that analyzing TCP header patterns can effectively distinguish legitimate traffic from potential threats, with 20-byte headers and zero sequence numbers as strong indicators of malicious activity.

netscout.com · 7 min

TLDR InfoSec

SOC ASSESSMENT TOOL (WEB APP)

The SOC Assessment Tool provides a comprehensive assessment tool to evaluate the maturity of a Security Operations Center (SOC). It provides actionable insights upon completion of the assessment.

soc.tools.ssojet.com

TLDR InfoSec

10 BURP EXTENSIONS I ACTUALLY USE

A LinkedIn post by Ti3rius about 10 “hidden gem” burp extensions he commonly uses, which are not in the top 30 most popular in the BApp Store.

linkedin.com · 3 min

TLDR InfoSec

FROM REVERSE ENGINEERING TO CHEAT DEVELOPMENT: INTERNAL GAME HACKS WITH ASSAULTCUBE

This guide shows how to build an internal cheat for the AssaultCube game by injecting a custom DLL into the game's memory. It explains how to hook into game functions like damage and add advanced features such as aimbot and wallhacks. The project is intended to be a technical learning tool for understanding game memory and function hooking.

adminions.ca · 13 min

TLDR InfoSec

US SANCTIONS FIRM LINKED TO CYBER SCAMS BEHIND $200 MILLION IN LOSSES

The U.S. Treasury Department has sanctioned Funnull Technology, a Philippines-based company facilitating numerous malicious websites. These sites are connected to cyber scams that have resulted in over $200 million in losses for Americans. The sanctions aim to disrupt the operations of this company and its role in cybercrime.

bleepingcomputer.com · 2 min

TLDR InfoSec

MARK YOUR CALENDAR: APT41 INNOVATIVE TACTICS

Google's Threat Intelligence Group discovered APT41 using the "TOUGHPROGRESS" malware, which exploits Google Calendar for command and control communications. The malware is delivered through spear-phishing emails containing ZIP archives hosted on compromised government websites. To evade detection, the malware uses a three-stage infection chain (PLUSDROP, PLUSINJECT, and TOUGHPROGRESS) with advanced obfuscation techniques, including 64-bit register overflow and control flow obfuscation. Google disrupted the campaign by developing custom detection signatures, terminating attacker-controlled Calendar accounts and Workspace projects, and adding malicious domains to Safe Browsing blocklists.

cloud.google.com · 12 min

TLDR InfoSec

MICROSOFT AUTHENTICATOR NOW WARNS TO EXPORT PASSWORDS BEFORE JULY CUTOFF

Microsoft Authenticator will discontinue its password autofill feature in July, prompting users to either export their passwords or switch to Microsoft Edge.

bleepingcomputer.com · 2 min

TLDR InfoSec

APPLE SAFARI EXPOSES USERS TO FULLSCREEN BROWSER-IN-THE-MIDDLE ATTACKS

A vulnerability in Apple's Safari browser allows attackers to exploit a fullscreen trick to illicitly acquire user account credentials, prompting users to be cautious with sensitive data entry.

bleepingcomputer.com · 3 min

TLDR InfoSec

PARTIES BEHIND 2024 BIDEN AI ROBOCALL REACH DEAL IN LAWSUIT

Two parties involved in an AI-generated robocall that mimicked then-President Joe Biden and discouraged voting in the New Hampshire Democratic primary have agreed to settle a civil lawsuit filed by voting groups.

cyberscoop.com · 3 min